The correct answer is B because production workloads should authenticate using their attached service account identity, not a developer’s personal credentials or manually stored tokens. When deploying to Vertex AI, the service account used by the application must be granted the required Pub/Sub permissions, such as permissions to subscribe to or consume messages from the relevant topic or subscription. This follows least privilege and keeps access auditable at the service account level. Extracting and storing a user access token is insecure because tokens expire and are tied to a person. Secret Manager should not be used to store personal credentials for application runtime access. JSON private keys are also discouraged because they create long-lived credentials that increase operational and security risk.